CVE-2013-6438: apache http_server
Vulnerability summary
CVE-2013-6438 is a medium (CVSS 5.0) vulnerability in apache http_server. EPSS estimates a 27.50% chance of exploitation in the next 30 days, higher than 98% of scored vulnerabilities.
Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 1Timeline
- 18-03-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
27.50%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 27.50% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Apache1 product
- http_server≥ 2.2.0, < 2.2.27 | ≥ 2.4.1, < 2.4.9
Canonical1 product
- ubuntu_linuxEOL10.04 | 12.04 | 12.10 | 13.10
Debian1 product
- apache2< 2.4.9-1
Oracle1 product
- http_server10.1.3.5.0 | 11.1.1.7.0 | 12.1.2.0 | 12.1.3.0
4 vendors · 4 products
References
49 links- blogs.oracle.com/sunsecurity/entry/multiple_input_validation_vulnerabilities_in1X Refsource CONFIRMThird Party Advisory
Show all 49 references
- svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/util.c?r1=1528718&r2=1556428&diff_format=hX Refsource CONFIRMPatchVendor Advisory
- marc.info?l=bugtraq&m=141017844705317&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
- www.securityfocus.com/archive/1/534161/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
- www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlX Refsource CONFIRMThird Party Advisory
- marc.info?l=bugtraq&m=141390017113542&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
- archives.neohapsis.com/archives/bugtraq/2014-10/0101.htmlVendor AdvisoryX Refsource APPLEBroken Link
- www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlX Refsource CONFIRMThird Party Advisory
- lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlVendor AdvisoryX Refsource APPLEBroken LinkMailing List
